It seems that many blog posts related to fuel use (such as my post from yesterday about record oil prices [1]) are getting adverts about perpetual motion [2]. Note that the common usage of the term “Perpetual Motion” does not actually require something to move. A battery that gives out electricity forever would be regarded as fitting the description, as does any power source which doesn’t have an external source of energy. The most common examples of this are claims about Oxyhydrogen [3], this is a mixture of hydrogen and oxygen in a 2:1 ratio. The wikipedia page is interesting, apparently oxyhydrogen is used for welding metals, glass, and plastics, and it was also used to heat lime to provide theatrical lighting (”lime light”). So a mixture of hydrogen and oxygen does have real-world uses. The fraud comes in the issue of the claims about magnecules [4]. Magnecules are supposedly the reason for the “atomic” power of HHO gas (AKA Oxyhydrogen) which are repeated on many web sites. In brief, one mad so-called scientist (of course if he was a real scientist he would have experimental evidence to support his claims and such experiments would be repeatable) has invented entirely new areas of science, one of which involves magnetic bonds between atoms. He claims that such chemical species can be used to obtain free energy. The idea is that you start with water, end with water plus energy - then reuse the water in a closed system. Strangely the web sites promoting water fueled cars don’t seem to mention magnecules and just leave the “atomic energy” claim with no support - maybe magnecules are simply too crazy for them. The water fuelled car wikpedia page is interesting - it lists five different ways that water can actually be used in a car engine (which are based on sound scientific principles and which have been tested) and compares them to the various water fueled car frauds [5]. I’m not accepting any more comments on my blog about perpetual motion solutions to the petrol crisis (they just take up valuable space and distract people who want to discuss science). I’ll allow some comments about such things on this post though.

• [1] http://etbe.coker.com.au/2008/06/09/record-oil-prices/


• [2] http://en.wikipedia.org/wiki/Perpetual_motion


• [3] http://en.wikipedia.org/wiki/Oxyhydrogen


• [4] http://en.wikipedia.org/wiki/Magnecule


• [5] http://en.wikipedia.org/wiki/Water-fuelled_car

Share This

After thinking it over a couple of times, I did it. I told you here about the World Naked Bike Ride. Thousands of bikers, in over 130 cities around the world, voiced their concerns about the lack of caution drivers have towards us, about the abuse of fossil fuels for urban transportation, about the easy we are not to be seen. Many among us have been run over by careless drivers (in my case, no consequences except a broken helmet - And yes, MJ: although the impact was on the flat surface of the road and not on the kerb, the strength of the impact still amazes me). We feel naked against the motorized traffic. So, the WNBR decides to show it by taking the streets of our many cities - Naked.
It was a completely different experience of the massive naked Spencer Tunick photo, as we were there not just to show our freedom and enjoy, but to get the people to look at us. There were some of the same elements of comradeship and trust we had there (and, of course, that many of us learnt in Finland when we became GNUdists at DebConf 5's unforgettable saunas).
Anyway... I did not make the full route (I rode Chapultepec-Z calo-Diana, ~15Km, but missed the Diana-Gandhi-Cibeles part, maybe some 5Km) as I had an appointment I was already late for. But it was a unique, great experience. If you are interested, we got a fair share of press coverage. Oh, and I must say: I am famous now. And in my favorite newspaper, nothing less :).

#include <stdio.h>
#include <sys/types.h>
int main(int argc, char *argv[])
 
#ifdef LITTLE_ENDIAN
	printf("Little Endian defined\n");
#endif
 

On Linux/x86, this prints outputs little-endian. Unfortunately it also does so on the IBM BlueGene (Linux, GNU Libc), which is, by default, big-endian. (Thanks to my colleague Honore Tapamo for discovering this). It turns out that this is due to <sys/types.h> including <endian.h>, which has:

#define __LITTLE_ENDIAN 1234
#define __BIG_ENDIAN    4321
#define __PDP_ENDIAN    3412
/* This file defines  __BYTE_ORDER' for the particular machine.  */
#include <bits/endian.h>
   #ifdef  __USE_BSD
   # define LITTLE_ENDIAN  __LITTLE_ENDIAN
   # define BIG_ENDIAN     __BIG_ENDIAN
   # define PDP_ENDIAN     __PDP_ENDIAN
   # define BYTE_ORDER     __BYTE_ORDER
   #endif
   
   #if __BYTE_ORDER == __LITTLE_ENDIAN
   # define __LONG_LONG_PAIR(HI, LO) LO, HI
   #elif __BYTE_ORDER == __BIG_ENDIAN
   # define __LONG_LONG_PAIR(HI, LO) HI, LO
   #endif

We're working on a code at the moment that has LITTLE_ENDIAN defined in Makefiles on Little-Endian architectures. This all needs to be changed to something like IS_LITTLE_ENDIAN to avoid this issue. POSIX requires that all symbols beginning with an underscore, followed by a Capital letter or another underscore, are reserved for "the system". Unfortunately the reverse does not appear to be true, and this then is a collision with a symbol that programmers thought was unique to the code being defined in system headers but with different meaning. Is there a standard for detecting byte order? There doesn't appear to be in POSIX. Linux / libc provides __BYTE_ORDER but what other Operating Systems does this work on ? Tags endian, posix, underscores, programming, bsd, linux

It’s time for recommending five films again. I’ve also decided that I may reserve the last of the five for films I watched prior to starting these series. So here we go:

• Au revoir les enfants (Goodbye, Children): just watch it, really. (France, World War II, children in a school run by priests, but there’s a part I’m not telling you.)
• El bosque animado: a superb film that every Spanish person should watch. Magic comedy & drama set up in rural Galicia. Amazing Tito Valverde.
• eXistenZ: yet another one by David Cronenberg, involving futuristic video games this time. Quite a good see, but predictable ending?
• Billy Elliot: the kid who wants to dance ballet. Predictive and linear, but I just loved it, as I expected — maybe you will too. The scene where Billy says goodbye to Michael just completely and utterly broke my heart, probably because I identified so much with Michael.
• Now, Voyager: Bette Davis plays an ugly duckling, that obviously transforms into an awesome swan. Superb. Oh, and Bette Davis.

Lev t t pour tre frais et dispo pour la premi re s ance, je me suis pr par rapidement. La nuit a t assez courte, couch vers minuit pour finaliser le support de cours. Enfin, il est pr t. J'ai juste quelques ajustements y apporter et il partira pour l'impression. Mieux vaut tard que jamais ;) J' tais donc pr t 7h30 pour un petit d jeuner ma foi agr able au bord de la piscine et accompagn de Tisserin et de la superbe Grue Couronn e quelques dizaines de centim tres de moi ;) Un petit tour au coin wifi internet pour envoyer 2 ou 3 mails et me voil attendre. Tout compte fait, j'ai d attendre jusqu' 10h30 pour que l'on vienne me chercher. La salle n' tait pas disponible, les petits tracas administratifs de derni re minute. Une fois sur place l'ENA (Ecole Nationale de l'Administration) je me suis lanc pr senter le syst me 25 personnes. Mais impossible de faire fonctionner loe r troprojecteur mis ma disposition. Pb de configuration Xorg voir ce soir. Donc j'ai projet mes transparent fait avec MagicPoint g n r s en HTML sur une machine sous Windows. Apr s une br ve introduction nous voil partis dans le vif du sujet. Les stagiaires taient tout ou e et donc je n'ai pas m nag les informations dispens es. Repas 14h frugal pour ma part, je n'avais pas trop faim. Poulet en sauve, crudit s, riz, pommes de terre. Me voil reparti 15h pour la deuxi me partie de la journ e. J'ai demand aux stagiaires de se pr senter... Bon, il va falloir que je fasse les bases des syst mes Unix pour tout le monde sans exception. Seance fini vers 18h o je suis rentr l'h tel, seul. Donc au programme de la soir e, remplir mon billet quotidien, r cuper la conf Xorg me permettant d'utiliser le r troprojecteur, manger et ensuite rododo ;)

Dear Bastian let's fix your blog post.

Philipp thinks, the fact that rng is not using the information in /usr/share/bug renders rng unfit for release and upgraded the corresponding bugreport from wishlist to serious. Moreover: since I dared to downgrade the report back to wishlist he decided to remove rng from testing and block it until the bug is fixed.

s/Philipp/the Release Team/g. And yes, we believe that reportbug-ng goes against the Maintainers wishes, and doesn't help users that don't know how to report a bug (and which are rng audience unless I'm mistaken).

I don t want to heat the debate about this bug again, but Philipp s decision seems arbitrary for me and I wonder if the same standard is applied to every other Debian package.

It's not, it was discussed in the Release Team and was not Philipp on his own alone. And yes, the same standards of quality is wanted for every package in Debian.

I mean, rng has no release critical defects.

That's you claiming that, there have been really constructive remarks in both bug that we upgraded, and that I think explain wisely why the current reportbug-ng behaviour doesn't makes it a suitable reportbug tool right now. I think for example that Sam's and Michael Biebl contributions in both bugs are good explanations of what is wrong and why.

It just does not use the aforementioned scripts as additional information in bugreports does this really render the software unfit for release ?

Yes it does. Again, people that use rng are I think, less experienced users, who need guidance through the bug reporting process. The kind of users that often send annoying bug reports. Instead of lowering the annoyance factor, you aggravate it. In the end, rng makes the frustration higher, and totally fails to meet its primary goals: making bug reporting nicer, simpler, and more efficient for the Reporter and the Maintainer. While it's probably nicer for the reporter, you totally fail on the other part of the contract. And if you don't care about the Maintainer, then well, reportbug-ng is just a spam machine to them, and your careless attitude toward them is unfit for release for sure.

Exists. Feels nice. Makes me float. Is it real?
On the other hand... Fear exists as well...
And there even are nice sparks in my temporal reality...

Using org mode to write ikiwiki posts I have been much taken by org-mode in Emacs recently. Firstly, this has allowed me to actually effectively implement the tenets of Getting things done , which is amazing by itself. I always used to start with great enthusiasm, which rarely lasted longer than a week. Until org-mode. Then this is so amazingly flexible. It has better handling of tables and even a spreadsheet mode than anything I have used and it has a pretty decent HTML export function. I practically live in org-mode on work days now. I strongly recommend org-mode, from things like agendas, TODO lists, calendars, appointments, articles, and now Ikiwiki posts. I rarely ever use markdown, apart from blogging using Ikiwiki and thus, since I blog so infrequently, I rarely ever remember all the syntax. On the other hand, org-mode syntax is now at my finger tips so I decided it was time to write a Ikiwiki plugin so I can now write my blog posts using syntax I can actually remember. It is still rough around the edges firstly, this requires emacs23 (or, on Debian, there is the unofficial emacs-snapshot package), secondly, it uses hueristic hacks to prune away the bits of the stand alone HTML page that org-mode creates; all I can say is that it currently works for me, as you can see from this post. How git this is for mainlne inclusion is another matter. The code is here: org.pm. It can be dropped in to the Ikiwiki plug-in directory, and that s all you need. With this, Ikiwiki pre-process things in the input file, and then passes it to emacs to htmlize it.

I’ve got a load of boxes running Debian etch with Xen 3.0.3 with routed networking (rather than bridged, so I can do iptables and reverse path filtering etc in dom0). Since upgrading from Xen 2.x many moons ago, I’ve not known how to configure one virtual interface to have more than one IP. In the meantime, I’ve ended up doing nonsense like providing a VM with two interfaces just to give it two IPs. However, this interacts really badly with reverse path filtering unless you do a bunch of source-routing rocket science in the domU to send out through the right vif. So, I looked at the vif-route script and it seems to support iterating through a space-separated list of IPs, but I was totally unable to find any documentation or mailing list posts explaining how to format the IPs within the formerly-Python key/value Xen domain config file syntax. After a while playing with the parser and various levels of quoting, I found that actually, the correct amount of quoting is none at all, and also uncovered a bug in another script which prevents it from working correctly. In the hope that this might help others using Google and trying to achieve the same as me, here is my recipe for configuring Xen vif devices to have multiple IPs (note that I think this might be specific to Xen 3.0.x, as I believe 3.2.x introduces config files in the S-expression format which is what xenstore uses internally):

1. Configure your VM using this surprisingly obvious, but somewhat dubious syntax (including a second argument just to prove that yes, it really does work like that):
   
vif=['ip=1.2.3.4 5.6.7.8, mac=00:16:3e:01:23:45']

   When parsed into SXP by xm create, this sets the ip value correctly as a space separated list as the scripts expect:
   
(device (vif (ip '1.2.3.4 5.6.7.8') (mac 00:16:3e:01:23:45)))

2. Fix the bug in /etc/xen/scripts/vif-common.sh:
   
--- /etc/xen/scripts/vif-common.sh~ 2008-06-09 01:14:23.065065119 +0100
+++ /etc/xen/scripts/vif-common.sh 2008-06-09 01:11:06.599986274 +0100
@@ -103,7 +103,7 @@
if [ "$ip" != "" ]
then
local addr
- for addr in “$ip”
+ for addr in $ip
do
frob_iptable -s “$addr”
done

3. Set up multi-homed or aliased interfaces as normal in the domU (depending if you’re a ip or an ifconfig kinda guy).
4. Profit!

There is a bit of discussion on Planet Debian on dbus and HAL and how to handle the daemon restarting. Basically, our "hardware abstraction" layer is actually more like a policy layer: the kernel provides the real hardware abstraction, but its access control features are not fine grained enough, and there is no revocation of privileges. Right now, there are two systems in use: X11 for keyboard/video/mouse, and dbus/hal for the rest. X11 has no problems with access control, because any process that wants to talk to the X server is owned by the user sitting at that terminal, and when that user logged off, the X server got uninteresting for us. For other hardware, that model doesn't entirely work. KVM is unique in that it only affects one user, and there is a clear definition of that user going away. To summarize my desired policies:

Sound

is similar, but I often log out in the evening and have something playing while I fall asleep, so the policy on the sound device is that access is prolonged even after logging out.

USB drives

should be accessible to the user that plugged them in, and stay with them, even after they logged out, until they are disconnected. I'd like to have block level access to them and run my file system drivers in user space (so I can format a pen drive without administrative access to the machine). That does not apply to all USB drives, though, so I'd like to be able to "recognize" certain volumes and handle them differently, not so much as a security but as a safety measure.

Smart cards

should be like KVM, really. No one but me should ever be able to talk to my cards, because causing a DoS is just so easy — enter the wrong code three times, and I have a big problem. Obviously, that is part of the security that my card provides (if you want to upload Debian packages in my name, you have to steal my wallet and get my PIN right in the first three attempts).

USB phone handset

I'd like that phone to be able to receive calls anytime, even when no one is logged in, and the currently logged on user should be able to make a call (but not over my account).

Specialty hardware

like the JTAG adapter hanging off USB on my box need a different policy too.

Any of these (except for the smart card) might mean that the device could be connected and used for a very long time, longer than I can sit at the console. Unlike humans, who get only mildly annoyed if the display closes and applications need to be restarted, there are serious data consistency issues if connections break and need to be rebuilt — and the policy needs to allow for rebuilding the connection securely. If we want to allow for handing over a resource to a new instance of the server or the client, then the protocol needs to be aware of this, as we need to synchronize server and client state after a connection breakdown. It might be possible to create a session management layer for certain services (analogous to X11 toolkits that transparently handle rebuilding the widgets on restart without bothering the application about it), but it'd probably be difficult to do without a full protocol redesign, as data loss is simply not as acceptable as when talking to a human who can pick up the pieces and go from there.

I recently noticed that a very good way to safely read webcomics in the bath tub is an old laptop with a big screen (e.g. a IBM ThinkPad A-series like my 15” A31 which has a nice 1400×1050 resolution), a water proof keyboard, the screen-alike, keyboard only driven (hence the name) window manager ratpoison (other keyboard driven window managers like wmii or awesome probably will do as well as ratpoison) and a good keyboard driven web browser which can bind or by default has bound a key to follow <link rel="next" ... /> tags. Like Opera. Opera has bound the space bar to scroll one page down and if you reach the bottom of the page to go to the next page as labeled in the link tag. Additionally the full screen mode is helpful, too. Or the dream browser of all Emacs addicts, Conkeror, which has bound the function browser-follow-next to ]]. (Conkeror packages will hit Debian Experimental quite soon.) Or the GNOME feed reader Liferea which has bound Ctrl-Space by default to scroll down the content by one page and if you reach the bottom of the content go to the next unread item. With that equipment I can read my favourite web comics like Questionable Content (whose content seldomly is questionable :-) or Ozy and Millie (Think of a mixture of Calvin & Hobbes, Peanuts and Kevin & Kell) in the bath tub without drying my hands before reading the next comic or fearing water or health damage by the combination of water and computer. I just press one or two keys on the keyboard floating over my lap and have a good time. BTW: I’ve got a blue, non-branded one (packaging reveals it as “AirTouch Keyboard”, probably manufactured by SanChuan Electronics, China) with swiss-german layout from ARP Datacom (whose website offers no permanent links and insists on session cookies *puke*), but those from Keysonic or from ROCK seem to be very similar — nowadays they are also available in illuminated, miscellaneous colors and wireless, but only IP65, probably because of the necessarily accessible battery compartment. But this kind of having fun still has optimisation potential: non-flexibel water-proof keyboard (IP67 recommended, so those IP66 keyboards and mice recently posted at UF LOTD are probably not tight enough), flat screen mounted above the bath tub, etc. ;-) Or maybe a completely water proof laptop if such thing exists — Does it? One more note: In Debian Sid and Lenny recently a new tool called keynav has been added, which allows you to control the mouse quickly using the keyboard only. So with Sid or Lenny, I don’t even need an waterproof mouse or trackball if an application insists on mouse usage. ;-)

Stage 1 : working whilst tired, missed a critical dot in a command, removed system /etc/ instead of the local test ./etc/ of a root filesystem test build. Come home early to try to rescue the machine using /etc/ data from machines on the home network (same kernel, same users, same config).

Stage 2 : Get home, start up the office network, UPS alarm goes off, sparks and bang from my main machine, familiar smell of burnt electronics (again) and UPS seems now unable to provide any mains power, battery only.

Stage 3 : despite having the config, the broken laptop is still not fixed. Lots of packages are completely bust, resurrecting /etc/passwd, /etc/group and /etc/shadow from other machines at least provided login and chroot operation via the Lenny Debian installer. I don't want to have to reinstall this box but it is questionable whether setting everything up again after reinstalling is actually less work than fixing the broken config.

Result: My semi-VAC is ongoing, I'm back on my iBook laptop and I'm looking for a new UPS.

The most dynamic segment of the software industry that I'm aware of is web programming. Flamewars rage about frameworks and browsers and standards and whatnot, and the openness of the whole thing feels like some of the things that made me fall in love with computing as a whole and Free Software in particular. The problem with all that openness is that it's rather difficult to navigate. Aside from the obvious issues with browser incompatibilities, there's an enormous amount of software solutions on the server side, spanning languages, libraries, and frameworks. Each one is an ecosystem to itself, often being large and complicated.

This makes it rather difficult to do certain aspects of web programming well. You are constantly switching between tools and languages, as well as coding paradigms, in order to build a web app in full. You'll be writing HTML, CSS, and Javascript on the client side, each with its own peculiarities. On the server side you'll probably have settled on one language with its own very different varieties of coding style and patterns. Some, like Ruby on Rails, are their own unique brand of language that makes you work both in the DSL (Rails in this case) and the parent language (Ruby here). Template engines often will do the same thing, such as in the case of Django.

It's pretty obvious that having to juggle all these tools places a fairly large burden on the coder. Much to their credit, it's not difficult to work in any of these languages, but to work in them at a high level becomes more difficult the deeper and wider the software stack reaches. You get this a bit in systems programming, juggling C/C++ with a build system and a scripting language, but that's usually it. You can get that number of moving parts just on the client side of the web with HTML, CSS, and Javascript.

Something interesting that seems to be happening is that people are moving to decrease this cognitive burden. One good example is the Google Web Toolkit which lets you write all your AJAXy client-side stuff in Java, and let it get compiled in to Javascript. That way you cut the languages you have to work in. A similar concept is behind Microsoft allowing Ruby (and Python, if I've heard correctly) in Silverlight. Alternately, you can bring Javascript (back) to the server side, which is the motivation behind Helma and Rhino on Rails (the latter of which I hope sees the light of day).

Personally, I'm rooting for Javascript to not become an assembly language, but to take over the server side again. It's a capable and powerful language (much better than Java in my opinion), and we're collectively leveraging it very poorly. Rhino is interesting and has enormous potential, but it needs library binds in the worst way. Currently it's basically using Javascript to write Java, which is rather atrocious (COBOL in any language, etc) but with some Javascript-style wrappers around the Java classes it could be phenomenal. Alternately, there's Spidermonkey, which could be wrapped in a more capable shell with a good FFI, and we could easily have wrappers to our favorite Free Software libraries. This project seems far along here, but it's currently very windows-centric.

There's a lot of potential here though. Unifying the development language for both web and system apps would benefit the Free Software desktop, and give us the ability to better integrate our stuff with the web. One of the best things about Free Software is that it dropped the barrier to entry in software development. I think we can repeat that success again here.

(Playing Kraftwerk - The Telephone Call.) Warning: This is a long-wound complaint post. The only reason this is going to the Planet is because I have no method yet of disabling individual posts for syndication. Please skip, with my apologees for the noise, if you don’t want to listen to complaining. May contain nuts. May drive you nuts. Drove me nuts. Mmm, pistachio. When I was around 11, I got my first cellphone. I was very proud. This was back when being 11 and having a cellphone was a real novelty; pagers were still being sold, and the NMT network was still running. Like many things I appreciate, I found it in a dumpster. It was ancient, even then: a Motorola MicroTAC brick, missing its antenna. I borrowed one of my grandmother’s hairpins, and voila, working phone - as long as you didn’t leave Oslo. It had a certain cyberpunk look to it, even then: I loved it. I remember that I first bought a NetCom pay-as-you-go card; I don’t quite remember the number, but it had “283″ in it at the end, if you want to wardial. For some reason, Dad needed a SIM card so I gave him mine. So I bought myself a new one, a Telenor card, pay-as-you-go, number 91 85 95 08. I must have been around 12 at the time. And that number served me very well. Fast-forward 6 years, to late March, 2006. I had just turned 18, and one of the first things I wanted to do was get a massively cheaper, proper subscription. I’d been procrastinating it for a bit - as I am wont to - but when a nice gentleman at the subway station told me about a nice new company called SEA Norway and their wonderful prices, I accepted. Big mistake. Here begins the saga of woe… For a good while, I was very happy with their service - even though GPRS data never worked, I never used it anyway. Their name changed to Vitel somewhere along the way. I received a phone call from an enthusiastic salesman who told me how much cheaper Vitel’s power subscription is. It seemed very reasonable, so I went for it. One of the arguments he gave me was that I could collect all those utilities into one bill. I told him that I couldn’t have this: Since I’m a live-alone student, my power bill is covered entirely by the city council, so I need a proper bill to hand over every month. “Sure, that’s no problem”. I check and double-check that, and I stress it. Sure, no problem. OK, deal. Big, big mistake. They draw 2700 Kroner from my account, using the automated pay system (AvtaleGiro) that I had set up for the phone bill. 2700 Kroner (530 US Dollars) is a lot of money, especially when your monthly income, 5000 Kroner (1000 US Dollars) barely covers the necessities. So I cancel the autopay system. (I still have not received that money!) 23rd of January, my subscription is cut, since I hadn’t paid the bill. They hadn’t mailed it to me, and I’d told them I’d cut the AvtaleGiro, but I simply did not receive the bill. So I call them up in February some time and try to figure out a solution. “You didn’t pay the bill, so the subscription is closed.” -”So if I pay the bill, will you reopen it?” -”No, sorry. It is closed now.” -”So then I’ll have to transfer the number to another provider?” -”No, you can’t do that; it’s closed now.” -”You can’t refuse to transfer the number, that’s simply not legal.” -”Sure it is, the subscription’s been closed.” Urgh. So some time in the middle of March, before The Gathering, I call NetCom up: I want to transfer my number to them, please. Sure, no problem. No, this number is registered as active in our system. All is well. We’ll make the switchover on March 28th, and you will get your SIM card in the mail: It should be in your box by then. Fantastic! The 28th of March came and went with no great ceremony, not even a SIM card. No switchover occurred. I give them the benefit of the doubt for more than a fortnight. Some time in April, then, I get sufficiently annoyed to call them up and ask what had happened. “Oh, no, it seems Vitel is using the old transferral system”. -”OK?” -”Yes, you will have to send us a form with your signature by fax to carry this transfer out.” -”Sigh, alright. Where can I get this form?” -”I’ll email it to you.” Great. So I get the form. May was very busy, so I didn’t get an opportunity to fill the form out, and by now I was getting fairly tired of the whole thing anyway! The thing that finally got me, however, was a bill from Vitel - on the “closed” subscription - for not only the monthly fee, but also several kroner of SMS “content services” (Read: ring tones) and GPRS data (Which never even worked even when the subscription did!) So last Tuesday, June 3rd, I send them the damned fax. Wednesday, June 4th, I call NetCom up and ask what the status is of my subscription. “Oh, yes, this is now active with us.” -”Really?!” (I was happy in the way that only someone who’s gone 5 months without a working phone could be.) -”Sure, we’ve sent the SIM card to Bekkeveien (something).” -”…Bekkeveien? But I’ve never lived at any Bekkeveien. My last name is Bekkedal, but..” -”Alright, then that’s probably a mistake. What you can do, though, is go to a NetCom dealer and pick up a new SIM card.” -”Perfect! I’ll do that, then.” (I stress “pick up” for a reason which will later become apparent.) Goodie. I’ll get a working phone! I was very happy as I took the tram down to Aker Brygge and looked everywhere for the damned NetCom dealer. Having finally found it, I happily stride inside and ask for a SIM card for my subscription. “Sure. That’ll be 200 Kroner.” Argh! I hadn’t brought enough money! She did say pick up. Oh well. Aker Brygge is a center of business, I’m sure there are other shops. So I ask to use one of their phones to call NetCom. Sorry, no phones you can use. Sigh. Fine. Do you know of any phone booths around? They didn’t, but I found one anyway, finally. I deposit the necessary $1 for a local call (See, this is the problem with having a cellphone company run the phone booths!) and dial NetCom customer service. They take my number and - Sorry, that number isn’t yet active, it’s still registered to Vitel. ARGH! Fine. So what’s standing in the way? Well, Vitel can’t refuse it - (thanks, I know that already) - but the form that I was sent wasn’t the right form. The form I need to send is from Vitel to Vitel, authorizing the transfer.While I’m trying to hold a conversation with the customer support guy, some drunk guy is accusing me of stealing phones, and begins reading out loud the sponsor company names on the back of my DebConf T-shirt. But Vitel has already told me that I cannot transfer this number, under any circumstance! They consider it closed! “Yes, but you have to talk to Vitel.” -”I have!” -”Well, we can’t really do anything…” Alright. So I hang up and I try to call Vitel. But that doesn’t work: They closed at 3 PM!. So finally tired of Netcom failing to port my number for a while, I call Telenor. I talk to a very cheerful and helpful lady who admits to not knowing about the particulars of that situation. Fantastic! At least she isn’t going to fib it! She says that she has a vacation Thursday, but she can call me back on Friday after discussing the matter with the number transfers department. Wow! She’s actually going to confer with the relevant expertise! This is too good to be true! So she said she’d call me back Friday at 1PM with a status update. As I am writing, it is Friday at 11:01, I am anxiously awaiting the telephone call. But now I get a funny SMS message:

From: NetCom Message from NetCom: Your number has been ordered by another operator. We would like to remind you that violation of the commitment period will be billed to the order of 1500 kroner. For questions, call 05050.

My subscription with Vitel was made in 2006, more than the 12 months I and knowledgeable friends believe to be the maximum legal commitment period (I doubt I would have agreed to more anyway!). Besides, the text message keeps saying that it’s from NetCom. So my deduction is: It’s from NetCom, who I have registered an active subscription and are now complaining that I’ve moved the subscription I’ve opened with them (but which they have not successfully moved from Vitel), over to Telenor. I don’t think this is an unfair conclusion. So I call NetCom customer service - which to NetComs infinite credit is a number you always can call, almost like 112 (technically it’s accomplished completely differently, but you get my point. The number is never blocked in a blocked subscription.) And they say it’s not from NetCom, even though it says it’s from NetCom. So I’ll keep both of my readers posted on the developing situation. At least the text message indicates that something is happening with my subscription. I just want the dialtone!

For once, the the action of an otherwise stupid ISP, namely blocking port 25 outgoing, was probably the right thing to do. Yes, in comcasts case, it apparently was communicated badly, and of course you have to be able to get it unblocked easily, but I think if all big providers would either block 25 outgoing alltogether for their consumer offerings or would block it for hosts they see spamming (pattern: smtp connections to more than 20 hosts within one minute perhaps?) the world would be a better place. OTOH spammers are already reacting: the percentage of spam I'm receiving through regular MXen (as per reverse DNS), including Yahoo and Google, (but not gmx so far, interestingly) is increasing markedly these months.

Regular readers of this blog (ed: oxymoron alert) may recall tales of woe with our beloved (ha!) cable internet provider such as this; then there are of course minor tales like this or this or this or the other stories on on this page but I am probably forgetting others. Anyway, yesterday's highlight was initiated with a mail, seemingly sent to all customers, informing me that

ACTION REQUIRED: Comcast has determined that your computer(s) have been used to send unsolicited email ("spam"), which is generally an indicator of a virus. For your own protection and that of other Comcast customers, we have taken steps to prevent further transmission of spam from your computer(s).

and the email went on to recommend some Windows anti-spam measures, including a reference to a page I could only open with IE at work and one URL to a page that doesn't exist. Nice. Not. Needless to say, there are now Windows computers sending mail (via Comcast) here (as the lone windows box, my wife's work laptop goes straight to her university webmail). And obviously, they blocked port 25, so no more mail sending from home. So I grumpily logged a compaint having been on hold and in telephony menu hell for fifteen or twenty minutes. I was promised to hear back in 72 hours. Hasn't happened yet, naturally, but we're only half way through... Anyway, to make a long story short and this post constructive: Here is what you do on a Debian or Ubuntu system running exim as your mail transport:

• sudo editor /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp_smarthost and add a line port = submission in the remote_smtp_smarthost block (assumming you have the split configuration chosen for the exim4-config package). Setting port to 'submission' switches from plain old STMP to the authenticated version running on port 587; submission is mapped to 587 in /etc/services.
• sudo editor /etc/exim4/passwd.client and add your user and password id as e.g. for comcast web-login
• sudo update-exim4.conf to update the configuration
• sudo /etc/init.d/exim4 restart to restart exim

And it may pay to check /var/log/exim4/mainlog for any irregularities. Barring those, you should now be sending mail to you smarthost using authenticated transfer over port 587. In the meantime, it looks like they unblocked port 25 at some point today...

In May 2002 I had an idea for securing access to GNUPG [1]. What I did was to write SE Linux policy to only permit the gpg program to access the secret key (and other files in ~/.gnupg). This meant that the most trivial ways of stealing the secret key would be prevented. However an attacker could still use gpg to encrypt it’s secret key and write the data to some place that is accessible, for example the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg“. So what we needed was for gpg to either refuse to encrypt such files, or to spawn a child process for accessing such files (which could be granted different access to the filesystem). I filed the Debian bug report 146345 [2] requesting this feature. In March upstream added this feature, the Debian package is currently not built with --enable-selinux-support so this feature isn’t enabled yet, but hopefully it will be soon. Incidentally the feature as currently implemented is not really SE Linux specific, it seems to me that there are many potential situations where it could be useful without SE Linux. For example if you were using one of the path-name based MAC systems (which I dislike - see what my friend Joshua Brindle wrote about them for an explanation [3]) then you could gain some benefits from this. A situation where there is even smaller potential for benefit is in the case of an automated system which runs gpg which could allow an attacker to pass bogus commands to it. When exploiting a shell script it might be easier to specify the wrong file to encrypt than to perform more sophisticated attacks. When the feature in question is enabled the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg” will abort with the following error:
gpg: can’t open /root/.gnupg/secring.gpg’: Operation not permitted
gpg: symmetric encryption of /root/.gnupg/secring.gpg’ failed: file open error Of course the command “gpg --export-secret-keys” will abort with the following error:
gpg: exporting secret keys not allowed
gpg: WARNING: nothing exported Now we need to determine the correct way of exporting secret keys and modifying the GPG configuration. It might be best to allow exporting the secret keys when not running SE Linux (or other supported MAC systems), or when running in permissive mode (as in those situations merely copying the files will work). Although we could have an option in gpg.conf for this for the case where we want to prevent shell-script quoting hacks. For editing the gpg.conf file and exporting the secret keys we could have a program similar in concept to crontab(1) which has PAM support to determine when it should perform it’s actions. Also it seems to me that crontab(1) could do with PAM support (I’ve filed Debian bug report 484743 [4] requesting this). Finally one thing that should be noted is that the targeted policy for SE Linux does not restrict GPG (which runs in the unconfined_t domain). Thus most people who use SE Linux at the moment aren’t getting any benefits from such things. This will change eventually.

• [1] http://www.gnupg.org/


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=146345


• [3] http://securityblog.org/brindle/2006/04/19/security-anti-pattern-path-based-access-control/


• [4] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484743

Share This

(update with right spellings for Catalan names, thanks Guillem) So, we (Elizabeth and /me) spent four days in May-end in Barcelona...without my laptop. That was already 2 weeks ago but it took me time to cook this blog entry..:-) Indeed, we enjoyed that a lot. That city is deeply appealing and friendly, and welcoming, and etc. Elizabeth found a good, though expensive, hotel in the city center, close to La Rambla (career Junta de Comer for those who care)....but far enough from La Rambla's noise..:-) The city is of course full of tourists...just like us...but, in some way, it absorbs the "load" very well and it doesn't look like the Touristorama that Paris turns into from May to September, for instance. It probably comes from the city having several interesting places to go without hard "hot spots" where all international buses of hurried folks run around like a sheep cattle...:-) Of course, we went to the "famous" places and, well, we enjoyed them a lot. For instance, the city hot spot, namely La Sagrada Familia... I wouldn't really have guessed that I would enjoy it that much. I was expecting something crazy and full of religious crap, just like Paris' "Sacre Coeur". I actually found a marvel of modern architecture. The portal of Passion is....astonishing and its modern sculpture framework is full of emotion. The inside, though still under huge work left me thrilled. That forest of pilars, the size of the ceiling and the elegance of all this is....wonderful. Really, I hope I'll live enough to see the end of this. We spent more than 4 hours there... La Rambla is as well somethign one has to enjoy. Of course full of crappy tourist-oriented stuff....but also a really living place and a place where one just want to "ramble on". We visited Park G ell on Friday with the best weather we had. Just sitting there on the terrace and enjoy the sun and some music by a quite good trumpetist was a great first introduction to the week-end. We wandered a long time around Montjuich hill, enjoying the view on the city. Definitely a place I would love running in if I was a Catalan. We also wandered through Gr cia which was a separate village in the past, though close to city's center. Nice walk in small places. Go there on evenings. The Musuem of the City's history is also a place to go. Great visit of remainings of the Roman and post-Roman city, under places just near to the cathedral. We were also lucky to see the Corpus Christi procession with Giants and related things (interrupted by rain, unfortunately) as well as attend a local "sardane" contest on a small place close to the cathedral on Saturday. Just friendly and nice being sitting there. We also went on some event I have no idea about, which featured some kinds of "fratenities" of people in a procession, with many giant flags (I mean *really giant*: about 5-8 meters high and held by one single person). We followed them for 1-2 kms in the avenues around the University after seeing them from the bus...:-) Barcelona's transport system is great. We had the great idea to buy "Barcelona cards" which just give you free access to bus, trains, metro, tram and several reduced fees to museums and such other places. This way, we could go around the city without walking too much and be too tired... If you do so some day, just use busses. They go everywhere, are very fast and they come often, even on Sundays. The metro is faster but you don't see the city. My favourite bus line is 24. Another option is the bicycle rental system. It seems fairly easy to use and, just like Paris V'lib, you find bicycles everywhere. Just remember that you'll ride in Spain (the same stands for Paris...) so buy eyes for all around your head. I still have so many things to say about Barcelona, but I want to complete that blog entry. In short, go there and enjoy. It deserves it. Ah, and if you live in Barcelona (and are not veg'), just try the "Biblioteca" restaurant in Junta de Comer o (I hope I remember the name well...anyway there are not that many restaurants in that street). We went there two nights in a row just because we wanted to try more stuff from their great menu..:-).

I think that for the first time, when I go to vote this November, I will probably not have to hold my nose as I make a selection for president. I don't agree with Obama on everything, of course, but the core of what he stands for -- that it is time to enter a post-racial, post-partisan time -- and that putting the interests of the people before those of the corporation -- is a powerful message.

And I'm not the only one that thinks so. One interesting read is Why This 55-Year-Old White Lifelong Republican Wants Obama To Win by Frank Schaeffer. He's a pro-life, pro-military Republican that actually campaigned for McCain in 2000, and this year he's supporting Obama. He pointed out another key point: Obama does not play on our fears.

Then there's A Transformational Moment by Jim Wallis, who grew up in a time when white people that supported civil rights were literally putting their lives on the line. He ends with:

This morning I heard several interviews on NPR with black Americans about their response to Obama's nomination. One older woman said, "A black man running for president, did you hear what just I said? A black man running for president of the United States ...." She just kept repeating the words, and succinctly captured my own personal feelings.

Yes, it is truly historic, and the U.K. newspaper headlines captured that sentiment as did papers around the world. Nothing could change the image of America around the world more than this. But it is more than historic; it is very personal for many of my generation. A new generation just sees this as natural -- he's an inspirational leader who happens to be black, which matters little to them. But for my generation -- I'm dating myself now -- this is a transformational moment, one we didn't think would come in our lifetimes. Race was the issue that changed us, shaped us, determined our path, and even defined the meaning of our faith. Now a black man is running for president of the United States. Amazing grace.

Tom Hayden reflects on the similarities between Obama and RFK, another interesting read. He concludes with:

Those who denounce Obama -- and the possibilities of all electoral politics- - should ponder the effectiveness of sitting judgmentally on the sidelines while an Unexpected Future arrives through the sheer will of a new generation. They should consider whether politics and history can be reduced to a fixed determinism that is endlessly repeated, as if there are no surprises. We can have our differences with Obama's specific policies, as I certainly do, but those should be measured against the prospect that a movement might transform him even as his very rise continues to transform the rest of us.

And now for something less inspiring. If you go look over at the latest blog entry at hillaryclinton.com and read the comments, these readers frankly sound more than a little loony. There are rampant accusations that Obama "stole the election" with the help of the DNC. That makes no sense to me; he followed the rules, and the DNC gave Clinton more delegates than she should have had with the rules as they were at the start of the game (which she supported then). The Obama campaign even rejected a plan that was less favorable to Clinton at the DNC rules committee meeting on Saturday. They also go on and on about how Obama has had so many scandals (though the Clinton real estate scandals really are far more serious than a former pastor). It all looks so very petty, and I wonder why Clinton has whipped up her supporters to such a fervent extent. Perhaps it was an accident, but you'd think things like this are rarely an accident with her.